CVE-2026-71502
Full vulnerability record from the local CVENow database.
Description
CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application's configured [[ ... ]] delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue. Vue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript Function constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application's nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the unsafe-eval policy exception. The malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful exploitation could allow the attacker to: * Access data available to the victim through the application. * Extract API keys, tokens, or other sensitive information exposed to the page. * Perform authenticated actions using the victim's session. * Modify conversions or other application data. * Escalate the impact by targeting an administrator. A demonstrated payload can use [].constructor.constructor(...) to obtain the JavaScript Function constructor and execute arbitrary code. The regression tests also show that a short first-stage payload could retrieve an uncapped conversion description and evaluate a larger second-stage payload. The patch addresses the vulnerability by registering a global Jinja finalize hook that inserts a zero-width Unicode word joiner inside every Vue delimiter found in server-rendered values. This prevents Vue from recognizing the values as template expressions while preserving their visible representation.
View original CVE JSON
{
"id": "CVE-2026-71502",
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"published": "2026-08-08T22:16:34.360",
"lastModified": "2026-10-24T15:10:00.190",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data.\n\nAn unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application's configured [[ ... ]] delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue.\n\nVue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript Function constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application's nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the unsafe-eval policy exception.\n\nThe malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful exploitation could allow the attacker to:\n\n * Access data available to the victim through the application.\n * Extract API keys, tokens, or other sensitive information exposed to the page.\n * Perform authenticated actions using the victim's session.\n * Modify conversions or other application data.\n * Escalate the impact by targeting an administrator.\n\n\nA demonstrated payload can use [].constructor.constructor(...) to obtain the JavaScript Function constructor and execute arbitrary code. The regression tests also show that a short first-stage payload could retrieve an uncapped conversion description and evaluate a larger second-stage payload.\n\nThe patch addresses the vulnerability by registering a global Jinja finalize hook that inserts a zero-width Unicode word joiner inside every Vue delimiter found in server-rendered values. This prevents Vue from recognizing the values as template expressions while preserving their visible representation."
},
{
"lang": "es",
"value": "CTI-Transmute contiene una vulnerabilidad de cross-site scripting almacenado causada por la neutralización insuficiente de los delimitadores de expresiones de plantilla de Vue en datos controlados por el usuario renderizados por el servidor.\n\nUn atacante no autenticado puede crear una conversión pública cuyo nombre o descripción contenga una expresión Vue maliciosa utilizando los delimitadores [[ ... ]] configurados de la aplicación. Los nombres de perfil de usuario pueden proporcionar un vector de inyección adicional. Aunque se aplica el escape HTML de Jinja, el valor resultante se incluye posteriormente en una región del DOM compilada por Vue.\n\nVue interpreta el valor controlado por el atacante como una expresión de plantilla en lugar de texto ordinario. Al acceder al constructor de funciones de JavaScript desde dentro de la expresión, un atacante puede ejecutar JavaScript arbitrario en el contexto de seguridad del origen de CTI-Transmute. La Política de Seguridad de Contenido basada en nonce de la aplicación no impide la explotación porque el compilador en tiempo de ejecución de Vue requiere la excepción de política unsafe-eval.\n\nLa carga útil maliciosa es almacenada por la aplicación y ejecutada cada vez que otro usuario abre una página afectada, como la página de detalles de conversión pública. La víctima puede ser un usuario normal o un administrador. La explotación exitosa podría permitir al atacante:\n\n * Acceder a datos disponibles para la víctima a través de la aplicación.\n * Extraer claves API, tokens u otra información sensible expuesta a la página.\n * Realizar acciones autenticadas utilizando la sesión de la víctima.\n * Modificar conversiones u otros datos de la aplicación.\n * Escalar el impacto al atacar a un administrador.\n\nUna carga útil demostrada puede usar [].constructor.constructor(...) para obtener el constructor de funciones de JavaScript y ejecutar código arbitrario. Las pruebas de regresión también muestran que una carga útil corta de primera etapa podría recuperar una descripción de conversión sin límite y evaluar una carga útil más grande de segunda etapa.\n\nEl parche aborda la vulnerabilidad al registrar un hook de finalización global de Jinja que inserta una unión de palabra Unicode de ancho cero dentro de cada delimitador de Vue encontrado en los valores renderizados por el servidor. Esto evita que Vue reconozca los valores como expresiones de plantilla mientras preserva su representación visible."
}
],
"affected": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"affectedData": [
{
"vendor": "misp",
"product": "cti-transmute",
"defaultStatus": "unaffected",
"repo": "https://github.com/MISP/cti-transmute",
"versions": [
{
"version": "0",
"lessThanOrEqual": "1.4.0",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-07T13:57:26.854958Z",
"id": "CVE-2026-71502",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-1336"
}
]
}
],
"references": [
{
"url": "https://github.com/MISP/cti-transmute/commit/4f43c9181a00262bec2a6dfbc9ff9c50d534e918",
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
},
{
"url": "https://github.com/MISP/cti-transmute/commit/522fa8ff8223b12a6128ea3fc2344a77b7b9108d",
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
},
{
"url": "https://github.com/MISP/cti-transmute/commit/ad8bf2b8031491cefb552314ef7ff6f4148ca95a",
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
},
{
"url": "https://github.com/MISP/cti-transmute/commit/ecfdaef63860a071c6f07afd30156ca77a77ad2b",
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
]
}